Your campus SOC detects command-and-control traffic from a wireless endpoint in a residence hall, and your Secure Firewall Management Center (FMC) is ready for Rapid Threat Containment. The segment never crosses the Threat Defense appliance, containment must start automatically when the event is processed, and the endpoint's live network access must be cut. Which Rapid Threat Containment action meets all three requirements for this host?

The FMC-to-ISE action is the right fit because ISE can change the authorization for the endpoint’s existing wireless session, cutting off its live network access without relying on traffic traversing the Threat Defense appliance. The FTD deny rule is a standard way to block a host when its traffic passes through that appliance, and FMC can automate policy deployment; here, however, the residence-hall segment bypasses the FTD, so the rule cannot affect this endpoint’s traffic. A wireless-controller quarantine role is also a common containment method, but applying it only at the next reauthentication leaves the current session active, failing the requirement to cut live access. Disabling the user’s directory account is a familiar incident-response step and can prevent later authentication, but it does not necessarily terminate an already authorized wireless session, so it does not meet the live-containment requirement. Exam caveat: distinguish a change to stored authorization or credentials from a session-level action that takes effect immediately; “automatic” alone does not guarantee immediate isolation. Practical check: verify in ISE that the endpoint’s session received the restrictive authorization and confirm that its formerly permitted network traffic is denied.